Are you compliant with Canadian privacy laws?

Who is this article for?

This article is for clinic owners and privacy officers who need to know whether Colib meets the Canadian privacy laws that apply to their practice, where their data is stored, and where to find the documents to keep in their compliance file.

The laws Colib complies with

Colib is compliant with the federal and provincial privacy laws that apply to clinics and health professionals in Canada:

Your clinic's role: when you use Colib, your clinic remains responsible for its client records and decides which information is collected and why. Colib acts as your service provider: it hosts and processes this information on your behalf, under strict confidentiality and security obligations. Colib gives you the tools, but compliance also depends on your own policies and practices (privacy policy, consents, person in charge of privacy, handling of access requests and incidents).

Where is your data stored?

All the personal and health information managed in Colib is stored in Canada, in the AWS Canada (Montréal) region: databases, files, documents and backups. Data is encrypted in transit and at rest, and backed up every day in Canada.

Artificial intelligence: your information is always stored in Canada, but the AI features (clinical note drafts, the rewriting assistant for notes, form extraction) send each request to the AI model, which processes it in memory, for the few seconds the request lasts, in Canada or in the United States. Nothing is stored, logged or kept there, and the content is not used to train AI models. These features are turned on by the clinic and triggered by the practitioner, and a client can refuse the use of AI on their record. All the details are in our artificial intelligence policy (www.colib.io/aipolicy).

A few other services are processed outside Canada, for example card payment processing by our payment partner, which never receives health information. The complete list is in the Data residency section of our privacy policy.

Documents for your compliance file

These public pages describe how Colib protects your information. You can share them with your professional order, your insurer or your clients:

• Security — the security measures of the platform: www.colib.io/security
• Privacy policy — what information is collected, who it is shared with, where it is stored, how long it is kept, rights and complaints: www.colib.io/privacypolicy
• Artificial intelligence policy — what the AI does, where it is processed and how your information is protected: www.colib.io/aipolicy
• Terms of use: www.colib.io/terms
• PIPEDA-compliant software: www.colib.io/pipeda-compliant-software
• Law 25 and your EHR: www.colib.io/loi-25-ehr
• Free self-assessments to check your own practice: www.colib.io/pipeda-compliance-checklist and www.colib.io/law-25-compliance-checklist

Colib's Privacy Officer handles requests and complaints about the protection of personal information. Their contact details are in the Privacy Officer section of the privacy policy.

Compliance guides by province

You will find more information here:

• Privacy: PIPEDA Compliance for Clinics in Canada
• Privacy: Compliance for Clinics in Quebec
• Privacy: Compliance for Clinics in Ontario
• Privacy: Compliance for Clinics in British Columbia
• Privacy: Compliance for Clinics in Alberta

Good to know

• Security measures — encryption, two-factor authentication, activity log, incident handling: see What data security and compliance measures does Colib offer?
• Who accessed a record? — see How to access the activity log.
• Clients' rights — How to record and track client consents in Colib, How to handle a client's request to correct their information, How to export my client data and the article titled "How to temporarily withhold a client's access to their record".
• Not legal advice — this article describes how Colib supports your compliance. For questions about your own obligations, refer to your professional order or a privacy advisor.

Still have a question?

Write to us at support@colib.io, we will be happy to help.